F´ (F Prime) EUVD-2026-101406

Requires a deployed Svc::GenericHub component (F´ 4.1.0-4.1.x) that receives hub packets from a remote or external source via fromBufferDriver, and the attacker must be able to deliver a crafted packet whose deserialized output-port field exceeds the configured output-port array bounds. The severe (heap corruption / RCE) outcome is LIMITED to builds compiled WITHOUT assertions enabled - on assert-enabled builds the same input triggers FW_ASSERT and aborts (availability impact only). Exploitation also presupposes attacker reachability to the hub's input channel/driver, which in F´ deployments is typically a mission radio link or inter-process transport rather than an open internet service.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3 Critical) describes a remote, unauthenticated, low-complexity flaw with high confidentiality, integrity and availability impact - consistent with CWE-129 improper array index validation leading to potential RCE. However, several real-world risk signals temper this: EPSS is not provided, the vulnerability is NOT in CISA KEV (no active exploitation), and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' Critically, impact is build-dependent - the description states assert-enabled builds merely abort (a DoS/availability event), while only builds compiled WITHOUT assertions suffer out-of-bounds access, heap corruption and possible RCE; the full VC:H/VI:H/VA:H outcome therefore applies only to assertion-disabled (typically flight/release) builds. No CVSS 3.1 vector was supplied (only 4.0), so 3.1-based tooling comparisons rely on this analysis's independent assessment. Net: a genuinely high-severity memory-safety flaw in a reachable network dispatch path, but real-world urgency is bounded by the narrow deployment base (NASA F´ embedded/spaceflight systems) and absence of any observed exploitation or public exploit code - prioritize for affected F´ operators, not a broad internet emergency.

An attacker with access to the communication link or driver feeding a Svc::GenericHub (e.g., a radio/uplink or inter-process channel) sends a crafted hub packet whose embedded output-port index falls outside the configured output-port array. On assert-disabled flight/release builds the unchecked index is passed to serialOut_out/bufferOut_out/eventOut_out/tlmOut_out, causing an out-of-bounds array access and heap corruption that may escalate to remote code execution; on assert-enabled builds it instead aborts. No public exploit code is identified at time of analysis.